What is the primary purpose of security policy in information assurance?

A. ignoring risks and controls B. deleting backup copies without approval C. removing all documentation D. a high-level management statement for information security